UAT: Session export checksum stored as raw hex instead of spec-required "sha256:<hash>" format #1352

New issue

Open

opened 2026-04-02 16:57:29 +00:00 by freemo · 0 comments

freemo commented

2026-04-02 16:57:29 +00:00

Owner

Bug Report

Feature Area: Session export/import — checksum format

What Was Tested

The checksum field in the session export dict produced by Session.as_export_dict() in src/cleveragents/domain/models/core/session.py was compared against the specification's documented format.

Expected Behavior (from spec)

The specification shows the checksum with a sha256: prefix in the Integrity panel:

╭─ Integrity ──────────────────╮
│ Checksum: sha256:7a9b...42c1 │
│ Encrypted: no                │
╰──────────────────────────────╯

And in the JSON output:

"integrity": {
  "checksum": "sha256:7a9b...42c1",
  "encrypted": false
}

Actual Behavior

The code stores the checksum as a raw 64-character hex string without the sha256: prefix:

# src/cleveragents/domain/models/core/session.py lines 407-409
canonical = json.dumps(export, sort_keys=True, default=str)
export["checksum"] = hashlib.sha256(canonical.encode()).hexdigest()
# Produces: "fc45eaec31a322520f3d017276abf57cb39d72e0d838131db913662018ea3c65"
# Expected: "sha256:fc45eaec31a322520f3d017276abf57cb39d72e0d838131db913662018ea3c65"

Steps to Reproduce

from cleveragents.domain.models.core.session import Session
from ulid import ULID

session = Session(session_id=str(ULID()))
export_data = session.as_export_dict()
print(export_data['checksum'])
# Output: "fc45eaec31a322520f3d017276abf57cb39d72e0d838131db913662018ea3c65"
# Expected: "sha256:fc45eaec31a322520f3d017276abf57cb39d72e0d838131db913662018ea3c65"

Code Location

src/cleveragents/domain/models/core/session.py line 409: export["checksum"] = hashlib.sha256(canonical.encode()).hexdigest()
src/cleveragents/application/services/session_service.py lines 250–254: checksum validation on import (also needs updating to strip sha256: prefix before comparison)

Additional Notes

The import validation in session_service.py recomputes the checksum using hashlib.sha256(...).hexdigest() (raw hex), so it is internally consistent. However, both the export and import need to be updated together to use the sha256: prefix format.
The encrypted field is also missing from the export dict entirely (see related issue about missing Integrity panel).

Severity

Low — The checksum mechanism is functionally correct (integrity is verified on import). The format deviation from the spec is a cosmetic/interoperability issue but could cause problems for external tools that parse the checksum field.

## Bug Report **Feature Area:** Session export/import — checksum format ### What Was Tested The checksum field in the session export dict produced by `Session.as_export_dict()` in `src/cleveragents/domain/models/core/session.py` was compared against the specification's documented format. ### Expected Behavior (from spec) The specification shows the checksum with a `sha256:` prefix in the Integrity panel: ``` ╭─ Integrity ──────────────────╮ │ Checksum: sha256:7a9b...42c1 │ │ Encrypted: no │ ╰──────────────────────────────╯ ``` And in the JSON output: ```json "integrity": { "checksum": "sha256:7a9b...42c1", "encrypted": false } ``` ### Actual Behavior The code stores the checksum as a raw 64-character hex string without the `sha256:` prefix: ```python # src/cleveragents/domain/models/core/session.py lines 407-409 canonical = json.dumps(export, sort_keys=True, default=str) export["checksum"] = hashlib.sha256(canonical.encode()).hexdigest() # Produces: "fc45eaec31a322520f3d017276abf57cb39d72e0d838131db913662018ea3c65" # Expected: "sha256:fc45eaec31a322520f3d017276abf57cb39d72e0d838131db913662018ea3c65" ``` ### Steps to Reproduce ```python from cleveragents.domain.models.core.session import Session from ulid import ULID session = Session(session_id=str(ULID())) export_data = session.as_export_dict() print(export_data['checksum']) # Output: "fc45eaec31a322520f3d017276abf57cb39d72e0d838131db913662018ea3c65" # Expected: "sha256:fc45eaec31a322520f3d017276abf57cb39d72e0d838131db913662018ea3c65" ``` ### Code Location - `src/cleveragents/domain/models/core/session.py` line 409: `export["checksum"] = hashlib.sha256(canonical.encode()).hexdigest()` - `src/cleveragents/application/services/session_service.py` lines 250–254: checksum validation on import (also needs updating to strip `sha256:` prefix before comparison) ### Additional Notes - The import validation in `session_service.py` recomputes the checksum using `hashlib.sha256(...).hexdigest()` (raw hex), so it is internally consistent. However, both the export and import need to be updated together to use the `sha256:` prefix format. - The `encrypted` field is also missing from the export dict entirely (see related issue about missing Integrity panel). ### Severity **Low** — The checksum mechanism is functionally correct (integrity is verified on import). The format deviation from the spec is a cosmetic/interoperability issue but could cause problems for external tools that parse the checksum field.

Rows
Columns